Overview

overview

10

Static

static

3

aed48a1bff...18.exe

windows7-x64

10

aed48a1bff...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    aed48a1bff7b09c7a37cd0d49695db28_JaffaCakes118

  • Size

    794KB

  • Sample

    240820-l9akwazfkp

  • MD5

    aed48a1bff7b09c7a37cd0d49695db28

  • SHA1

    2cc7e919c06f0d351753b13b6ee346217780d0f8

  • SHA256

    a8acba9d91c15bd4d86f38631c59a9b1bfb6e679203e7bd0ae334d6445e7fb9c

  • SHA512

    5bc82ab8312ba52e89605280ade96e21e3ce158d80bbada1f411ae21cba889d135a6538c27d30315ed8e5e6862214423bdf99e507f9479279ea8ed577d5cc16f

  • SSDEEP

    12288:xvRRy90KMRv26TA7Qh6vWjPjkDQoyazsfDiVZlbTIAwil5EiVWRZATzC3G:dyURu8A8PjGwLiVZpIA97EMWRaTmW

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      aed48a1bff7b09c7a37cd0d49695db28_JaffaCakes118

    • Size

      794KB

    • MD5

      aed48a1bff7b09c7a37cd0d49695db28

    • SHA1

      2cc7e919c06f0d351753b13b6ee346217780d0f8

    • SHA256

      a8acba9d91c15bd4d86f38631c59a9b1bfb6e679203e7bd0ae334d6445e7fb9c

    • SHA512

      5bc82ab8312ba52e89605280ade96e21e3ce158d80bbada1f411ae21cba889d135a6538c27d30315ed8e5e6862214423bdf99e507f9479279ea8ed577d5cc16f

    • SSDEEP

      12288:xvRRy90KMRv26TA7Qh6vWjPjkDQoyazsfDiVZlbTIAwil5EiVWRZATzC3G:dyURu8A8PjGwLiVZpIA97EMWRaTmW

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks